If this is your first visit, be sure to
check out the FAQ by clicking the
link above. You may have to register
before you can post: click the register link above to proceed. To start viewing messages,
select the forum that you want to visit from the selection below.

Developers using DBA_ROLE

I've created a development environment for a development team. I've created them a user account for the shema with (what I feel is) the requisite db privileges to develop (CREATE, ALTER, DROP etc. all necessary objects).

The Team Leader has now asked for it to be given full DBA privs.

I don't think this is appropriate. The schema is their responsibility, the database is mine (and believe me when something goes wrong it will be MY RESPONSIBILITY!). They don't have any on-board DBA skills in the team - they just ring me when they can't do a particular thing, like 'create us a database'!

I did read - somewhere - a cracking explanation of why it is dangerous to give developers (particularly ones who are not very database savvy) DBA privileges. I'd like to cherry pick some pertinent points from it to use in a response.

"The DBA Role
A predefined role, named DBA, is automatically created with every Oracle database. This role contains most database system privileges. Therefore, it is very powerful and should be granted only to fully functional database administrators."

They cry out that its only a dev server so what's the problem? Indeed, if they crash it it would be their problem I'm certainly not taking any flak there. But they're a lazy bunch and see our production systems as a source of test data to help them develop. So ... DBA gives them create DBLINK privs. Once they realised this I see several links from the Dev DBs to live systems. These are validated - supposedly SECURE!!! - systems and there are the developers throwing queries at it and its all okay "because its only a READ only link".

I'm not prepared to be responsible for securing our prod systems if I can't keep them secure. If this means keeping developers away from the DBA role (even on their dev box) then so be it.

Just out of interest what other damage could they do over a DB link (the account they connect to has SELECT only privs on all the schema tables)?

They should never get ad hoc access to the prod system, it would be all too easy to run a humdinger of a query that has an impact on perfromance (even if its read only).

DBA privs on development is also a bad idea (IMO) as development should be as close to live as possible so they can....errrrr.....develop against it. No point in them spending weeks writing code only to find it doesn't work in live (or UAT) because of something in dev is different to live.